Crypto Defense Ransomware

[Garfield]

Hi Lansweeper Support team,

Can the team kindly guide me on how to run a query to search for these files related to Crypto Defense ransomware, that are "How_decrypt.txt" and "How_decrypt.html", on all assets?

Regards,

Garfield

[Obi_1_Cinobi]

Hello there!

Custom file scanning might be able to assist: https://community.lansweeper.com/t5/scanning-your-network/windows-custom-file-scanning/ta-p/64272

[Garfield]

Thanks much for this, but the caveat is that there are no specific file paths; the files are normally on the C drive and or any drive, and not specifically in the Program Files folder. How would we do this custom system scanning in this case? As an example, 😧help\DataDictionary\HOW_DECRYPT.HTML

[Obi_1_Cinobi]

Hello there!

Unfortunately, you must submit the exact file path, including the drive, for custom file scanning, so that feature is not an option in this use case.

[Garfield]

Is it possible to scan via a Hash file Sha256 in Lansweeper and or registry entry? 

[Obi_1_Cinobi]

Have a look at our custom registry scanning feature to see if this suits your use case: https://community.lansweeper.com/t5/scanning-your-network/scan-registry-values-with-custom-registry-...